hooks.server.ts RawHistoryFolder

1import type { Handle } from "@sveltejs/kit";
2import { validateSessionToken } from "$lib/api/session.server";
3import { setSessionTokenCookie, deleteSessionTokenCookie } from "$lib/api/session.cookie";
4
5export const handle: Handle = async ({ event, resolve }) => {
6    console.debug("Handling request:", event.url.pathname);
7    
8    // Check if this is a public chat messages request
9    const isPublicChatRequest = 
10        event.url.pathname === '/api/chat/messages' && 
11        event.url.searchParams.get('public') === 'true' &&
12        event.request.method === 'GET';
13    
14    // Check if this is a public room request
15    const isPublicRoomRequest = 
16        event.url.pathname.startsWith('/api/rooms/') && 
17        event.url.searchParams.get('public') === 'true' &&
18        event.request.method === 'GET';
19    
20    // Public routes that don't require authentication
21    const publicRoutes = [
22        "/",
23        "/api/session/login",
24        "/api/session/validate",
25        "/api/register",
26        "/login",
27        "/register"
28    ];
29    
30    // Get session token from cookies
31    const token = event.cookies.get("session") ?? null;
32
33    // Handle public requests separately: always clear session
34    if (isPublicChatRequest || isPublicRoomRequest) {
35        console.debug("Public request accessed:", event.url.pathname);
36        event.locals.user = null;
37        event.locals.session = null; // Public access doesn't require a session
38        return resolve(event);
39    }
40    
41    // Handle public routes: if token exists, validate and propagate
42    if (publicRoutes.includes(event.url.pathname)) {
43        console.debug("Public route accessed:", event.url.pathname);
44        if (token) {
45            const { session, user } = await validateSessionToken(token);
46            if (session !== null) {
47                console.debug("Valid session found on public route for user:", user?.nickname);
48                setSessionTokenCookie(event, token, session.expiresAt);
49                event.locals.session = session;
50                event.locals.user = user;
51            }
52        }
53        return resolve(event);
54    }
55
56    // Protected routes: ensure authentication
57    if (token === null) {
58        console.debug("No session token found");
59        event.locals.user = null;
60        event.locals.session = null;
61        return new Response("Unauthorized", { status: 401 });
62    }
63    
64    const { session, user } = await validateSessionToken(token);
65    if (session !== null) {
66        console.debug("Valid session found for user:", user?.nickname);
67        setSessionTokenCookie(event, token, session.expiresAt);
68        event.locals.session = session;
69        event.locals.user = user;
70        return resolve(event);
71    } else {
72        console.debug("Invalid session token");
73        deleteSessionTokenCookie(event);
74        event.locals.session = null;
75        event.locals.user = null;
76        return new Response("Unauthorized", { status: 401 });
77    }
78};